CVE-2026-65400 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 95.6%

Affected Products (NVD)

Vendor	Product	Version
apple	macos	14.0 ≤ 𝑥 < 14.8.9
apple	macos	15.0 ≤ 𝑥 < 15.7.9
apple	macos	26.0 ≤ 𝑥 < 26.6.1

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-287 - Improper Authentication
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Vulnerability Media Exposure

[GERMAN] Gefährliche Sicherheitslücke: Apple-Geräte lassen sich per Bluetooth kapern
Bei iPhones, iPads, Macs und anderen Apple-Geräten lässt sich ohne Zutun des Nutzers über Bluetooth Schadcode einschleusen. Neue Updates beheben das. ( Sicherheitslücke , Apple )
Published: 2026-09-17T09:20:03+02:00
[ENGLISH] ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy. Even the research side is getting messy, with more findings, more automation, and not
Published: 2026-09-21T19:54:13+05:30

References

https://support.apple.com/en-us/148170

https://support.apple.com/en-us/148171

https://support.apple.com/en-us/148172

https://support.apple.com/en-us/149035

https://support.apple.com/en-us/149042

http://seclists.org/fulldisclosure/2026/Aug/36

http://seclists.org/fulldisclosure/2026/Aug/37

https://advisories.ncsc.nl/2026/ncsc-2026-0280.html

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400